Windows executables and installer lack digital signatures by Blender Foundation. #48339

New Issue

Nathan Pietres · 2016-05-03T11:58:39+02:00

Nathan Pietres commented

2016-05-03 11:58:39 +02:00

Source: Links downloaded from multiple mirror locations (all of x64, x86, zip) from https://www.blender.org.
Example: blender-2.77a-windows64.msi
Issue: Files are not digitally signed.
Consequence: prevents Blender from being installed or run inside organizations whose IT policies prevent any external digitally unsigned executables from being executed on Windows machine, or executed/run by any other responsible person with a Windows machine.

Source: Links downloaded from multiple mirror locations (all of x64, x86, zip) from https://www.blender.org. Example: blender-2.77a-windows64.msi Issue: Files are not digitally signed. Consequence: prevents Blender from being installed or run inside organizations whose IT policies prevent any external digitally unsigned executables from being executed on Windows machine, or executed/run by any other responsible person with a Windows machine.

Nathan Pietres commented

2016-05-03 11:58:39 +02:00

Changed status to: 'Open'

Nathan Pietres commented

2016-05-03 11:58:39 +02:00

Added subscriber: @syncolp

Thomas Dinges commented

2016-05-03 12:02:23 +02:00

Added subscriber: @ThomasDinges

Thomas Dinges commented

2016-05-03 12:02:23 +02:00

Changed status from 'Open' to: 'Archived'

Thomas Dinges closed this issue

2016-05-03 12:02:23 +02:00

Thomas Dinges self-assigned this 2016-05-03 12:02:23 +02:00

Thomas Dinges commented

2016-05-03 12:02:23 +02:00

We don't sign binaries on Windows. That is not considered a bug.

Thomas Hofer commented

2016-06-22 16:00:24 +02:00

Added subscriber: @daGrinch

Thomas Hofer commented

2016-06-22 16:04:27 +02:00

Well... considering the installers are served over http, without TLS, downloaded binaries could be changed to malicious software by any network node on the path between the mirror and my computer.

Not signing the binaries leaves every user exposed to fairly simple yet devastating attacks.

That's reason enough for me to give up on getting started with Blender.

Well... considering the installers are served over http, without TLS, downloaded binaries could be changed to malicious software by any network node on the path between the mirror and my computer. Not signing the binaries leaves every user exposed to fairly simple yet devastating attacks. That's reason enough for me to give up on getting started with Blender.

Thomas Dinges commented

2016-06-22 16:12:04 +02:00

https://download.blender.org/release/ ;)

Thomas Hofer commented

2016-06-22 16:16:58 +02:00

Thanks. Much better. Still would feel safer with signed binaries, but much better than the download links on the download page.

And md5 fingerprints? Better than nothing for sure, but I thought the official stance on MD5 was: run away from it :)

Thanks. Much better. Still would feel safer with signed binaries, but much better than the download links on the download page. And md5 fingerprints? Better than nothing for sure, but I thought the official stance on MD5 was: run away from it :)

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Windows executables and installer lack digital signatures by Blender Foundation. #48339